Docker local file logging driver adds something to the beginning and end of the container log file

Question

I do json format in my nginx docker container and is ok from "docker logs" and it's look like well:

[root@ ~]# docker logs --tail 1 roundcubenginx

{ "time": "2022-02-18T22:59:01+00:00", "remote_addr": "63.143.42.250", "remote_user": "", "ssl_protocol_cipher": "TLSv1.3/TLS_AES_256_GCM_SHA384", "body_bytes_sent": "0", "request_time": "0.047", "status": "200", "request": "HEAD / HTTP/1.1", "request_method": "HEAD", "http_referrer": "https://xxx", "http_x_forwarded_for": "", "http_cf_ray": "", "host": "xxx", "server_name": "xxx", "upstream_address": "172.20.0.3:9000", "upstream_status": "200", "upstream_response_time": "0.047", "upstream_response_length": "0", "upstream_cache_status": "", "http_user_agent": "Mozilla/5.0+(compatible; UptimeRobot/2.0; http://www.uptimerobot.com/)" }

I can use jq to pretty json display:

[root@ ~]# docker logs --tail 1 roundcubenginx | jq .
{
  "time": "2022-02-18T22:59:01+00:00",
  "remote_addr": "63.143.42.250",
  "remote_user": "",
  "ssl_protocol_cipher": "TLSv1.3/TLS_AES_256_GCM_SHA384",
  "body_bytes_sent": "0",
  "request_time": "0.047",
  "status": "200",
  "request": "HEAD / HTTP/1.1",
  "request_method": "HEAD",
  "http_referrer": "https://xxx",
  "http_x_forwarded_for": "",
  "http_cf_ray": "",
  "host": "xxx",
  "server_name": "xxx",
  "upstream_address": "172.20.0.3:9000",
  "upstream_status": "200",
  "upstream_response_time": "0.047",
  "upstream_response_length": "0",
  "upstream_cache_status": "",
  "http_user_agent": "Mozilla/5.0+(compatible; UptimeRobot/2.0; http://www.uptimerobot.com/)"
}

Problem is when I try read the same log from file. At the beginning and end of each log is something like:

stdout�짂�����
�

[root@ ~]# tail -n1 /var/lib/docker/containers/5fbcf8b558beb93bc723daa9095f3102e91ed676564b1d965c6bf9d88022b06a/local-logs/container.log

stdout�짂�����{ "time": "2022-02-18T22:59:01+00:00", "remote_addr": "63.143.42.250", "remote_user": "", "ssl_protocol_cipher": "TLSv1.3/TLS_AES_256_GCM_SHA384", "body_bytes_sent": "0", "request_time": "0.047", "status": "200", "request": "HEAD / HTTP/1.1", "request_method": "HEAD", "http_referrer": "https://xxx", "http_x_forwarded_for": "", "http_cf_ray": "", "host": "xxx", "server_name": "xxx", "upstream_address": "172.20.0.3:9000", "upstream_status": "200", "upstream_response_time": "0.047", "upstream_response_length": "0", "upstream_cache_status": "", "http_user_agent": "Mozilla/5.0+(compatible; UptimeRobot/2.0; http://www.uptimerobot.com/)" }�[root@ ~]#

Because of this, I can't display a pretty json with jq.

[root@ ~]# tail -n1 /var/lib/docker/containers/5fbcf8b558beb93bc723daa9095f3102e91ed676564b1d965c6bf9d88022b06a/local-logs/container.log | jq .

parse error: Invalid numeric literal at line 1, column 21

Is strange but file log looks like binary not like log:

[root@ local-logs]# less /var/lib/docker/containers/5fbcf8b558beb93bc723daa9095f3102e91ed676564b1d965c6bf9d88022b06a/local-logs/container.log "/var/lib/docker/containers/5fbcf8b558beb93bc723daa9095f3102e91ed676564b1d965c6bf9d88022b06a/local-logs/container.log" may be a binary file. See it anyway?

My logging driver in docker is "local" -> https://docs.docker.com/config/containers/logging/local/

/etc/docker/daemon.json:
{
  "log-driver": "local",
  "log-opts": {
    "max-size": "10m"
  }
}

Anyone know how this can be prevented?

screen from less

Answer 1

The local logging driver is a binary format (with embed text that you're setting). This may be based on protobuf, but I'd need to dig through source to verify, but it's an implementation detail you are not expected to know, and docker could change it without warning.

The json-file driver is the default, and should be pure json, but it will use more disk space.

The recommended way to read logs is either to query them through the docker API (e.g. the docker logs cli), or to change the driver to send the logs to an external system designed for querying logs.